CVE-2023-22489 in flarum
Summary
by MITRE • 01/13/2023
Flarum is a discussion platform for websites. If the first post of a discussion is permanently deleted but the discussion stays visible, any actor who can view the discussion is able to create a new reply via the REST API, no matter the reply permission or lock status. This includes users that don't have a validated email. Guests cannot successfully create a reply because the API will fail with a 500 error when the user ID 0 is inserted into the database. This happens because when the first post of a discussion is permanently deleted, the `first_post_id` attribute of the discussion becomes `null` which causes access control to be skipped for all new replies. Flarum automatically makes discussions with zero comments invisible so an additional condition for this vulnerability is that the discussion must have at least one approved reply so that `discussions.comment_count` is still above zero after the post deletion. This can open the discussion to uncontrolled spam or just unintentional replies if users still had their tab open before the vulnerable discussion was locked and then post a reply when they shouldn't be able to. In combination with the email notification settings, this could also be used as a way to send unsolicited emails. Versions between `v1.3.0` and `v1.6.3` are impacted. The vulnerability has been fixed and published as flarum/core v1.6.3. All communities running Flarum should upgrade as soon as possible. There are no known workarounds.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 02/01/2023
CVE-2023-22489 represents a critical access control vulnerability in Flarum discussion platforms that stems from improper handling of discussion state management following post deletion operations. This vulnerability specifically affects versions between v1.3.0 and v1.6.3 where the platform fails to maintain proper access controls when a discussion's first post is permanently deleted while the discussion itself remains visible. The technical flaw manifests when the `first_post_id` attribute of a discussion becomes null after deletion, which subsequently bypasses all access control mechanisms for new replies. This condition creates a persistent security gap that allows unauthorized actors to submit replies regardless of their permissions or the discussion's lock status. The vulnerability operates under CWE-285 Access Control Flaw, specifically targeting improper authorization checks in API endpoints.
The operational impact of this vulnerability extends beyond simple unauthorized posting to include potential spam injection and unintended communication channels. When a discussion maintains at least one approved reply after the first post deletion, the system's comment count remains above zero, keeping the discussion visible and accessible. This creates a window where users who had previously accessed the discussion can continue posting even after the original access restrictions should have been enforced. The vulnerability particularly affects users without validated email addresses, as they can exploit this condition to create replies that bypass normal permission checks. Additionally, the issue combines with email notification settings to potentially enable unsolicited email distribution, creating a vector for abuse that could be leveraged for spam campaigns or unwanted communication.
The flaw demonstrates a fundamental breakdown in state management and access control validation within the Flarum platform's REST API implementation. When the first post is deleted, the system fails to properly update or validate the discussion's access control state, creating a persistent vulnerability that remains active until the discussion is properly restructured. This vulnerability requires a specific combination of conditions to be exploitable - the discussion must have at least one approved reply to maintain visibility, and the first post must be deleted to nullify the `first_post_id` attribute. The system's automatic behavior of making discussions with zero comments invisible serves as a protective mechanism that prevents exploitation in most cases, but when this protection is bypassed through the deletion operation, the security controls become ineffective. This represents a classic case of incomplete input validation and state management that allows privilege escalation through improper access control enforcement, potentially mapping to ATT&CK technique T1078 Valid Accounts and T1566 Phishing in its exploitation patterns. Organizations running affected versions should immediately implement the patched flarum/core v1.6.3 release to address this vulnerability, as no effective workarounds exist for this specific access control bypass condition.